The size of the ring is the product of ring_entries and the size of struct io_uring_buf. Using struct_size is equivalent to (ring_entries + 1) * sizeof(struct io_uring_buf) and generates a off-by-one error. Fix it by using size_mul directly.
Signed-off-by: Tudor Cretu tudor.cretu@arm.com --- io_uring/kbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index e2c46889d5fab..182e594b56c6e 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -509,7 +509,7 @@ int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) }
pages = io_pin_pages(reg.ring_addr, - struct_size(br, bufs, reg.ring_entries), + size_mul(sizeof(struct io_uring_buf), reg.ring_entries), &nr_pages); if (IS_ERR(pages)) { kfree(free_bl);